Even after two earlier pre-trust repairs, a code path that invoked git log remained sensitive to repository-local verifier settings. Where log.showSignature and a configured GPG program selected an external helper, the helper could execute at the developer account privilege before the tool completed its trust decision. The required Git configuration and…
Inspect the ClaimsCase · DiggingBeagle record
Mistral Vibe could run a Git signature helper before trust approval
A repository-configured signature program could be invoked by startup git log when signature display was enabled.
Public disclosure: Nov 4, 2026
Scope
Coding-agent initialization on prepared local repositories with the stated Git configuration or executable-search preconditions.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
Repository-enabled Git signature handling could execute a configured helper prior to trust; independent real-world deployment exploitation is not established. An impact band remains unassigned because the available evidence does not establish a comparable severity score or verified numerical loss for this assessment.
Assessed Nov 8, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-MISTRAL-VIBE-GPG-PRETRUST-01 · Vibe git log invoked repository-configured signature verifier before trust
At a glance
A workspace confirmation displayed after repository inspection cannot undo a subprocess that already ran.
Read the implicationsThe required Git configuration and signed-commit conditions limit reachability. The advisory does not identify a field campaign, and the prior 2.25.5 and 2.25.7 fixes did not cover this later path. Version 3.0.3 addresses it.
Limits and uncertaintyFull account
Even after two earlier pre-trust repairs, a code path that invoked git log remained sensitive to repository-local verifier settings. Where log.showSignature and a configured GPG program selected an external helper, the helper could execute at the developer account privilege before the tool completed its trust decision.
The required Git configuration and signed-commit conditions limit reachability. The advisory does not identify a field campaign, and the prior 2.25.5 and 2.25.7 fixes did not cover this later path. Version 3.0.3 addresses it.
The third pre-trust path came from signature verification requested by repository Git configuration: git log could invoke a configured gpg.program when log.showSignature was enabled. The attacker therefore needed an effective local Git configuration and a signed-commit inspection path. This is not identical to either a malicious git.exe or a filter driver, and the later 3.0.3 repair should be checked against all startup Git subprocesses, not inferred from earlier fixes.
Mechanism and trust boundary
- 01
Provide effective local Git signature-verification configuration.
- 02
Trigger startup git log on a matching signed commit.
- 03
Invoke the configured verifier before the repository is trusted.
Claims & evidence
CLM-MISTRAL-VIBE-GPG-PRETRUST-01A repository-configured signature program could be invoked by startup git log when signature display was enabled.supported
Basis: reported finding
- supportsVibe git log invoked repository-configured signature verifier before trustprimary disclosure
Advisory description; log.showSignature, gpg.program and fix 3.0.3
Implications
A workspace confirmation displayed after repository inspection cannot undo a subprocess that already ran.
Controls and mitigations
- Upgrade Mistral Vibe to at least 3.0.3 and test that startup git log cannot run a repository-controlled signature verifier before approval.
- Inventory all Git subprocesses that inherit local configuration; fixes to Git executable lookup and filters do not cover every helper.
Unknowns and contradictions
- The required Git configuration and signed-commit conditions limit reachability. The advisory does not identify a field campaign, and the prior 2.25.5 and 2.25.7 fixes did not cover this later path. Version 3.0.3 addresses it.
Sources and citation
Material revision history
- Nov 8, 2026 · Canonical change recorded · new in release · revision 229